I'm trying to create a user and only grant him search privileges on a specific index using cURL. So far I used these two commands:
curl -k -u admin:password https://SplunkIP:8089/servicesNS/admin/search/data/indexes -d name=mytest
And I found this command example for the user creation:
curl -k -u admin:password https://SplunkIP:8089/services/authentication/users -d name=User1 -d password=changeme -d roles=role
So as far, as I understood, I can directly affect an existing role while creating the User1 account, but I would like to create a specific role which allows him to only read and search from the mytest index.
I found a "createrole" parameter for the last cURL, but it's not clear from the documentation.
So is it possible to create / specify the role while creating a new user? Or is there any other cURL command which can create a role?
Thank you very much !
You can create a role for the user but not sure if you can customize the role that way. Better option is to create the role separately (before creating user) with all the customization (index access) and then assign that role to the user while creating (or update if already created). See this link for roles creation curl using Splunk REST API
Create a role
And Attach your filter to that role...
Check.. [role_<< roleName >>] --> srchFilter in https://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf
Give your filter in the field Restrict search terms in UI while creating role
And Assign that role to your User